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1 This action is in response to the communication filed on 4/9/2004. 

2 DETAILED ACTION 

3 Claims 1-44 have been examined. 

4 Title 

5 The title of the invention is not descriptive. A new title is required that is clearly 

6 indicative of the invention to which the claims are directed. 
7 

8 Information Disclosure Statement 

9 The information disclosure statement(s) (IDS) submitted on 4/9/2004, 7/21/2006, and 

1 0 9/28/2007 are in compliance with the provisions of 37 CFR 1 .97. Accordingly, the examiner is 

1 1 considering the information disclosure statements. 

12 Drawings 

13 The drawings filed on 4/9/2004 are acceptable for examination proceedings. 
14 

15 

16 Specification 

1 7 Applicant is reminded of the proper language and format for an abstract of the disclosure. 
18 

19 The abstract should be in narrative form and generally limited to a single paragraph on 

20 a separate sheet within the range of 50 to 150 words. It is important that the abstract not exceed 

21 150 words in length since the space provided for the abstract on the computer tape used by the 

22 printer is limited. The form and legal phra.seology often used in patent claims, such as "means" 

23 and "said, " should be avoided. The abstract should describe the disclosure sufficiently to assist 

24 readers in deciding whether there is a need for consulting the full patent text for details. 
25 

26 The language should he clear and concise and should not repeat information given in the 

27 title. It should avoid using phrases which can be implied, such as, "The disclosure concerns, " 

28 "The disclosure defined by this invention, " "The disclosure describes, " etc. 
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1 

2 The abstract of the disclosure is objected to because: 

3 The phrase "Implementations are described and claimed herein to enable" can be implied 

4 and therefore should be removed from the abstract. 

5 Correction is required. See MPEP § 608.01(b). 

6 Claim Objections 

7 Claim 33 is objected to because of the following informalities: Claim 33 lacks a 

8 terminating period. Appropriate correction is required. 

9 Claim Rejections - 35 USC § 101 

10 35 U.S.C. 101 reads as follows: 

1 1 Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or 

1 2 any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and 

1 3 requirements of this title. 

14 

15 Claims 17-32 are rejected under 35 U.S.C. 101 because the claimed invention is directed 



1 6 to non-statutory subject matter. In this case, the claims are directed towards a computer program 

17 product. A computer listing per se falls within the scope of a computer program product, and a 

1 8 computer listing per se is nothing more than non-ftinctional descriptive material. Furthermore, 

1 9 paragraph 0007 of the instant specification indicates that a carrier wave falls within the scope of 

20 a computer program product. In the event that such "computer program products" are intended 

21 to be limited to the hardware and software necessary to transmit, transport, receive and process 

22 the computer program product in such a manner as to enable the computer program product to 

23 act as a computer component and realize its functionality, it is believed that the claims in 

24 question would be directed to patent-eligible subject matter (statutory). However, no such 

25 evidence that the embodiment covered by the claims in question which is directed to the 
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1 "computer program product" is limited to inclusion of such hardware and software elements 

2 exists. Therefore, it is believed that the "computer program product", embodied as a carrier 

3 wave, would reasonably be interpreted by one of ordinary skill as the abstract idea of any portion 

4 of a communication, including the forms of energy, per se, used in communications. Absent 

5 recitation of the hardware, the claims appear devoid of any physical articles or objects which 

6 may cooperate to achieve some function, and as such are not directed to a machine. Likewise, 

7 absent any such physical article or object, they cannot be directed to a manufacture. They are 

8 clearly not a series of steps or acts themselves, and as such are not a process. They are clearly 

9 not a composition of matter. Therefore, the claims in question do not appear to fall within a 

1 0 statutory category of invention as set forth in 35 USC 101. 

1 1 Claim Rejections - 35 USC § 103 

12 The following is a quotation of 35 U.S. C. 103(a) which forms the basis for all 

13 obviousness rejections set forth in this Office action: 

14 A patent may not be obtained though the invention is not identically disclosed or 

15 described as set forth in section 102 of this title, if the differences between the subject matter 

1 6 sought to be patented and the prior art are such that the subject matter as a whole would have 

17 been obvious at the time the invention was made to a person having ordinary skill in the art to 

1 8 which said subject matter pertains. Patentability shall not be negatived by the manner in which 

19 the invention was made. 
20 

21 Claims 1-2, 4-18, and 20-44 are rejected under 35 U.S.C. 103(a) as being unpatentable 

22 over Burch et al. (US Patent Application Publication 2005/0171872) hereinafter referred to as 

23 Burch, and further in view of Brovick et al. ("WINDOWS® 2000 Active DirectoryTM") 

24 hereinafter referred to as Brovick. 



Application/Control Number: 1 0/82 1 ,603 Page 5 

Art Unit: 2131 

1 Regarding claims 1 and 17, Burch disclosed a method comprising: receiving an event 

2 notification (See Burch Paragraph 0043); and synchronizing the local credentials and remote 

3 credentials (See Burch Paragraph 0043-0044), but Burch failed to specifically disclose 

4 enumerating local credentials and remote credentials in response to the event notification. Burch 

5 did, however, disclose that the credential stores are directories (See Burch Paragraph 0022). 

6 Brovick teaches that Active Directory is a directory service, which provided replication 

7 of data between devices, as well as synchronization of the data between the devices in an Active 

8 Directory (See Brovick First Paragraph), and that in order to maintain synchronization between 

9 each copy of the directory, each update to a directory is provided with a USN which is compared 

10 with USNs in other devices to determine which updates need to be replicated (See Brovick 

1 1 "Keeping Track"). 

1 2 It would have been obvious to the ordinary person skilled in the art at the time of 

1 3 invention to employ the teachings of Brovick in the credential store system of Burch by utilizing 

14 Active Directory to provided the directory service and the synchronization between the 

1 5 credential stores. This would have been obvious because the ordinary person skilled in the art at 

1 6 the time of invention would have been motivated to provide quick and efficient directory 

17 services across the distributed credential store. 

18 Regarding claim 33, Burch disclosed a system comprising: an event handler to 

19 receive event notifications (See Burch Paragraph 0043-0044); and a synchronizing module 

20 operatively associated with the event handler to synchronize local credentials and remote 

2 1 credentials if the local and remote credentials are different from one another (See Burch 

22 Paragraph 0043-0044), but Burch failed to specifically disclose that the synchronization occurred 
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1 when the event handler receives the event notification. Burch did, however, disclose that the 

2 credential stores are directories (See Burch Paragraph 0022). 

3 Brovick teaches that Active Directory is a directory service, which provided replication 

4 of data between devices, as well as synchronization of the data between the devices in an Active 

5 Directory (See Brovick First Paragraph), and that in order to maintain synchronization between 

6 each copy of the directory, each update to a directory is provided with a USN which is compared 

7 with USNs in other devices to determine which updates need to be replicated (See Brovick 

8 "Keeping Track"), and that the synchronization between the devices occurred upon an event 

9 notification (See Brovick "Keeping Track"). 

1 0 It would have been obvious to the ordinary person skilled in the art at the time of 

1 1 invention to employ the teachings of Brovick in the credential store system of Burch by utilizing 

1 2 Active Directory to provided the directory service and the synchronization between the 

13 credential stores. This would have been obvious because the ordinary person skilled in the art at 

14 the time of invention would have been motivated to provide quick and efficient directory 

15 services across the distributed credential store. 

1 6 Regarding claims 2 and 1 8, Burch and Brovick taught that synchronizing the local 

17 credentials and the remote credentials is based on at least one time-stamp associated with the 

1 8 local credentials and at least one time-stamp associated with the remote credentials (See Brovick 

19 Conflict Resolution). 

20 Regarding claims 4 and 3 1 , while Burch and Brovick did not specifically teach that the 

2 1 synchronizing included error handling, it was well known in the art of data transmission to 
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1 include error handling, and therefore would have been obvious to the ordinary person skilled in 

2 the art at the time of invention to have done so. 

3 Regarding claims 5 and 20, Burch and Brovick taught writing at least one of the local 

4 credentials to a remote credential cache (See Burch Paragraph 0056). 

5 Regarding claims 6 and 2 1 , Burch and Brovick taught writing at least one of the remote 

6 credentials to a local credential cache (See Burch Paragraph 0053). 

7 Regarding claims 7-8 and 22-23, while Burch and Brovick taught that changes in local 



8 credentials are duplicated in the remote credential store, and vice versa, they failed to specifically 

9 disclose deleting remote credentials. However, addition and deletion of credentials in a 

10 credential store is well known, and would have been obvious to the ordinary person skilled in the 

11 art at the time of invention. This would have been obvious because the ordinary person skilled in 

12 the art would have been motivated to have allowed flexibility in the authorizations granted 

13 within the system by allowing authorizations to be granted and taken away. 



14 Regarding claims 9 and 24, Biirch and Brovick taught modifying at least one of the local 

1 5 credentials at a local credential cache based on at least one of the remote credentials (See Burch 

16 Paragraph 0053). 

17 Regarding claims 10 and 25, Burch and Brovick taught modifying at least one of the 

1 8 remote credentials at a remote credential cache based on at least one of the local credentials See 

1 9 Burch Paragraph 0056). 

20 Regarding claims 1 1 and 26, Burch and Brovick taught updating a list of local credentials 

2 1 (See Brovick "Keeping Track"). 
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1 Regarding claims 12 and 27, Burch and Brovick taught updating a list of remote 

2 credentials (See Brovick "Keeping Track"). 

3 Regarding claims 13, and 29, Burch and Brovick taught determining a state of the remote 

4 credentials dynamically (See Brovick "Intra-Site Rephcation" and "Inter-Site Replication"). 

5 Regarding claims 14 and 28, Burch and Brovick taught maintaining a state file for the 

6 remote credentials (See Brovick "Keeping Track"). 

7 Regarding claims 15 and 30, Burch and Brovick taught maintaining a state file for the 

8 local credentials (See Brovick "Keeping Track"). 

9 Regarding claims 1 6 and 32, Burch and Brovick taught resolving a conflict of state 

10 between the local credentials and the remote credentials (See Burch Paragraph 0044 and Brovick 

1 1 "Conflict Resolution"). 

12 Regarding claim 34, Burch and Brovick taught that the event notification is at least one of 

13 the following: a session event, a logon event, a logout event, a lock event, an unlock event, a 

14 timer event, a policy application event, and a credential update event (See Burch Paragraph 

15 0046). 

1 6 Regarding claim 35, Burch and Brovick taught that the credentials include at least one of 

17 the following: an encryption credential, a token, an asymmetric key pair, a symmetric key, a 

1 8 digital certificate, an XrML license, an authentication credential, an authorization credential (See 

1 9 Burch Paragraphs 0022-0024). 

20 Regarding claim 36, Burch and Brovick taught that a local store manager to enumerate 

2 1 the local credentials for the synchronizing module (See Brovick "Keeping Track"). 
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1 Regarding claim 37, Burch and Brovick taught that a remote store manager to enumerate 

2 the remote credentials for the synchronizing module (See Brovick "Keeping Track"). 

3 Regarding claim 38, Burch and Brovick taught that the local credentials are stored in a 

4 local cache (See Burch Paragraph 0053). 

5 Regarding claim 39, Burch and Brovick taught that the local credentials are stored in a 

6 local cache provided at any number (n) of clients (See Burch Paragraph 0053). 

7 Regarding claim 40, Burch and Brovick taught that the local credentials are encrypted 

8 using a master key (See Burch Paragraph 0025). 

9 Regarding claim 4 1 , Burch and Brovick taught that the remote credentials are stored in a 

10 remote cache (See Burch Paragraph 0056). 

1 1 Regarding claim 42, Burch and Brovick taught that the local credentials are stored in a 

12 remote cache provided at any number (n) of hosts (see Burch Paragraph 0056). 

13 Regarding claim 43, Burch and Brovick taught that the remote credentials are maintained 

14 by a remote directory service (See Biirch Paragraphs 0022 and 0056). 

1 5 Regarding claim 44, Burch and Brovick taught that the remote credentials are encrypted 

1 6 (See Burch Paragraph 0025). 

17 Claims 3 and 19 are rejected under 35 U.S.C. 103(a) as being unpatentable over the 

18 combination of Burch and Brovick as applied to claims 1 and 17 above, and further in view of 

19 Yianilos et al. (US Patent Application Pubhcation 2002/0029214) hereinafter referred to as 

20 Yianilos. 

2 1 Burch and Brovick disclosed detection of changes between local and remote credentials, 

22 but failed to disclose that the synchronizing was based on a comparison of hash values. Yianilos 
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1 teaches an alternative method for detecting differences between entries in a synchronization 

2 system which involves generating a hash for the local data and a hash for the remote data, and 

3 comparing the hashes, wherein if the hashes are different then a change has been detected and 

4 synchronization is required (See Yianilos Paragraphs 0083 - 0084). 

5 It would have been obvious to the ordinary person skilled in the art at the time of 

6 invention to employ the teachings of Yianilos in the synchronization system of Burch and 

7 Brovick by detecting changes by comparing hashes of the local and remote credential stores. 

8 This would have been obvious because the ordinary person skilled in the art would have been 

9 motivated to minimize the network traffic generated by the synchronization. 



10 Conclusion 

1 1 Claims 1-44 have been rejected. 

1 2 The prior art made of record and not relied upon is considered pertinent to applicant's 

13 disclosure. 

14 Any inquiry concerning this communication or earlier communications from the 

1 5 examiner should be directed to MATTHEW T. HENNING whose telephone number is 

16 (571)272-3790. The examiner can normally be reached on M-F 8-4. 

17 If attempts to reach the examiner by telephone are unsuccessful, the examiner's 

18 supervisor, Ayaz Sheikh can be reached on (571) 272-3795. The fax phone number for the 

19 organization where this application or proceeding is assigned is 571-273-8300. 
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1 Information regarding the status of an application may be obtained from the Patent 

2 Application Information Retrieval (PAIR) system. Status information for published applications 

3 may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 

4 applications is available through Private PAIR only. For more information about the PAIR 

5 system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 

6 system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 

7 like assistance from a USPTO Customer Service Representative or access to the automated 

8 information system, call 800-786-9 1 99 (IN USA OR CANADA) or 57 1 -272- 1 000. 
9 

10 

1 1 /Matthew T Henning/ 

1 2 Examiner, Art Unit 2131 

13 /Ayaz R. Sheikh/ 

1 4 Supervisory Patent Examiner, Art Unit 2131 
15 



